AiTM Credential Harvesting

Adversary-in-the-middle phishing that intercepts a user’s authentication flow and captures session material or credentials in transit. In modern identity programmes, it matters because the attacker is stealing the authenticated session outcome, not merely the password.

Expanded Definition

AiTM credential harvesting is a phishing technique in which an attacker places themselves between the user and the legitimate service, relaying the login session while capturing credentials, session cookies, or token material. Unlike simple password theft, the attacker is targeting the authenticated outcome of the flow, which can bypass MFA if the session is reused.

In NHI and IAM operations, the term is often discussed alongside session hijacking, token theft, and reverse-proxy phishing, but definitions vary across vendors on whether a captured bearer token, a one-time code, or a full session artifact qualifies as “credential harvesting.” NHI Management Group treats the term as the collection of usable authentication material in transit, regardless of the prompt that exposed it. That distinction matters because controls must address the authentication ceremony, the session lifecycle, and the trust placed in downstream tokens, not just the password field. Standards such as the NIST SP 800-63 Digital Identity Guidelines reinforce that authenticators and session handling are separate security concerns.

The most common misapplication is calling every phishing event AiTM Credential Harvesting, which occurs when a message steals a password but never intercepts an active authentication exchange.

Examples and Use Cases

Implementing defenses against AiTM Credential Harvesting rigorously often introduces friction in the login experience, requiring organisations to weigh stronger session protection against user convenience and support overhead.

• A reverse-proxy phishing page relays a real sign-in flow to Microsoft 365 or another IdP, then captures the issued session cookie for reuse.
• An attacker intercepts an OAuth login ceremony, obtains a bearer token, and uses it to access APIs without knowing the password.
• A remote workforce logs in through an email link or device code flow, and the attacker harvests the completed session after the user approves the prompt.
• An incident review shows that a compromised NHI or exposed secret enabled lateral movement after the attacker first stole a human session, linking the event to broader secret exposure patterns described in the Guide to the Secret Sprawl Challenge and the OWASP Non-Human Identity Top 10.
• Security teams simulate adversary-in-the-middle tactics to test conditional access, token binding, and phishing-resistant authentication before production rollout.

Practical response patterns often combine phishing-resistant authenticators, session binding, and rapid revocation of issued tokens, especially where service accounts or workload-facing consoles are reachable through the same identity plane.

Why It Matters in NHI Security

AiTM Credential Harvesting matters to NHI security because stolen sessions can become the bridge from a human compromise into privileged automation, CI/CD tooling, cloud consoles, and secret stores. Once an attacker can impersonate the user behind an approval or management action, they may retrieve secrets, mint new tokens, or alter workload permissions without triggering password-based controls. This is why NHI Management Group repeatedly warns that secret exposure and identity sprawl are mutually reinforcing risks in modern environments, as shown in the The 2024 Non-Human Identity Security Report and the LLMjacking: How Attackers Hijack AI Using Compromised NHIs research.

That report found that only 19.6% of security professionals express strong confidence in their organisation’s ability to securely manage non-human workload identities, underscoring how weak identity boundaries amplify the impact of a hijacked session. The risk is not limited to humans: once an authenticated actor can reach a secrets vault or cloud control plane, the attacker can pivot from one session into many machine identities. Controls in NIST SP 800-53 Rev 5 Security and Privacy Controls and the NHI guidance ecosystem should therefore be applied to session assurance, token protection, and revocation speed, not only to password policy. Organisations typically encounter the severity of AiTM Credential Harvesting only after a valid session is abused to drain secrets or alter access, at which point the term becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Why do AiTM phishing attacks create more risk than ordinary credential theft?
• Why do AI agents create new risk for credential harvesting and intrusion workflows?
• Credential Harvesting
• Tool Credential Harvesting